# SPDX-License-Identifier: GPL-2.0-or-later
# SPDX-FileCopyrightText: 2025 GNOME Foundation, Inc.

[Unit]
Description=Regularly Update Parental Controls Web Filtering Daemon
Documentation=man:malcontent-webd(8)

[Service]
ExecStart=/usr/libexec/malcontent-webd-update
Type=oneshot
RemainAfterExit=yes
TimeoutSec=infinity
NotifyAccess=main
User=malcontent-webd
StateDirectory=malcontent-webd
RestartMode=debug

# Sandboxing
CapabilityBoundingSet=
Environment=GIO_USE_VFS=local
Environment=GVFS_DISABLE_FUSE=1
Environment=GVFS_REMOTE_VOLUME_MONITOR_IGNORE=1
Environment=GSETTINGS_BACKEND=memory
IPAddressDeny=any
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateIPC=yes
PrivatePIDs=yes
PrivateTmp=yes
PrivateUsers=yes
ProcSubset=pid
ProtectClock=yes
DeviceAllow=
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
PrivateNetwork=yes
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=yes
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallErrorNumber=EPERM
SystemCallFilter=@basic-io @file-system @io-event @ipc @network-io @process @sync
SystemCallArchitectures=native
UMask=0022

[Install]
WantedBy=multi-user.target